Data Privacy Statement - Ötztal Tourismus

Ötztal Tourismus
Achweg 5
6450 Sölden
+43 (0) 57200 0
hereinafter referred to as "Controller" or "we".

Data protection officer: Mr. Roland Grüner, dsb@oetztal.com

Ötztal Tourismus takes the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the currently valid data protection regulations as well as this data privacy statement. Personal data (e.g. name, e-mail address, telephone number, etc.) will only be processed by the Controller if there is a sufficient legal basis and for the purposes stated in the data privacy statement or individually.

When contacting Ötztal Tourismus e.g. via e-mail, social media, telephone or on-site, the following details are partially processed for handling the request as well as for answering follow-up questions that might arise: salutation, fist and last name, e-mail address, telephone number, street, post code, country. In addition, other specified data concerning the request will be processed. In general, collected personal data will be deleted within 12 months after completion of the processing of the request. In the event of a contract being concluded, personal data will be deleted after expiry of the relevant warranty, f guarantee or damage claims or after expiry of the statutory retention periods.

If you voluntarily provide us with "sensitive" data (special categories of personal data within the meaning of Art. 9 GDPR) (e.g. existing allergies or your religious confession), this will only be done on the basis of your explicit consent to data processing for the purpose of handling your request. This consent can be revoked at any time by sending a message to Ötztal Tourismus (dsb@oetztal.com).

Personal data disclosed by the user will only be processed by the operator to the extent actually required for the processing of the request and/or the provision of the requested service. According to Art. 6 (1) lit. b GDPR, these data processing operations are required to fulfill the contract or, respectively, to carry out pre-contractual measures. In some cases, data processing operations also take place in the common interest of Ötztal Tourismus (Art. 6 (1) lit f GDPR - regarding in particular: customer service, granting of loyalty discounts, defense against liability claims).

In the course of this data processing operation, Ötztal Tourismus also partially forwards personal data collected to the processor (see 13. processor). If there is a legal or regulatory obligation, data will also be transmitted to public authorities (Art. 6 (1) lit. c GDPR).

If you place an order in one of our shops (e.g. adventure shop), by telephone or on our websites or carry out a booking of a room via Ötztal Tourismus or book any other travel service, we will collect data required or, respectively, entered by you for the handling of your order/reservation/booking. These are - in particular - your name, your telephone number, your address and e-mail address ("contact details") as well as the date of your arrival and departure, your hotel and the type of the booked room ("booking information"). In addition, other personal data is sometimes collected and processed which is useful for the provision of the service; this concerns, for example (in the example of the arrangement of the ski rental) your shoe size, sole length, weight, skiing ability, ID, etc.

This data will only be processed by the operator to the extent actually required for the processing of the request and/or the provision of the requested service. According to Art. 6 (1) lit. b GDPR, these data processing operations are required to fulfil the contract or, respectively, to carry out pre-contractual measures.

When you make a booking at Ötztal Tourismus, your booking information will be forwarded to the selected accommodation provider/service provider in order to make your reservation possible at all. Your data will not be sold or rented to third parties by Ötztal Tourismus.

In the course of this data processing operation, the Operatur also partially forwards personal data collected to the processor (see 13. processor). If there is a legal or regulatory obligation, data will also be transmitted to public authorities (Art. 6 (1) lit. c GDPR).

If you also register as a user, point 07. user accounts of the "Data Privacy Statement - Websites/APPs/Services" also applies.

To fulfill the legal obligations of Ötztal Tourismus or its members in the sphere of the official guest registration system (Registration Act, Registration Act Implementation Ordinance, Tyrolean Residence Tax Act, Tourism Statistics Regulation, etc.), Ötztal Tourismus will only process anonymized data, insofar as the registering person (usually the accommodation provider) supports the electronic registration system. An allocation of the data to individualized persons is not given and also not possible. If the registering person (usually the accommodation provider) does not support the electronic registration system, the aggregated data (country of origin, post code, year of birth of the guest, dates of arrival and departure, obligation to pay residence tax) of the guests in accommodation establishments or in leisure residences are processed by Ötztal Tourismus. This is maximum pseudonymized data, which could only be assigned to specific persons in connection with the guest directories to be kept by the accommodation providers.

The collected data is transferred to the respective municipality in fulfilment of legal obligations. These data processing operations are therefore carried out on the basis of a legal or regulatory obligation (Art. 6 (1) lit. c GDPR).

As a guest in the area of Ötztal Tourismus, you have the possibility to use the Digital Travel Guide of Ötztal Tourismus. When using this Digital Travel Guide, your personal data will be processed by Ötztal Tourismus. In order to use the Digital Travel Guide of Ötztal Tourismus, it is possible to register on the respective Progressive Web App (abbreviated PWA) of the Digital Travel Guide of Ötztal Tourismus via a terminal device (e.g. smartphone, PC) and to create a profile. The user can use the services of the Digital Travel Guide by registration or, respectively, identification. In order to use the information offers and to receive service offers from the operator, it is necessary to register by providing an e-mail address. In this respect, consent to the processing of data to create a user profile and to send marketing newsletters constitutes the consideration for the provision of the Digital Travel Guide and services related thereto.

In this context, Ötztal Tourismus collects your name and your e-mail address, residential address, date of birth, your interests in products, your travel data, insofar as this is necessary or expedient for the provision and use of the offers of the Digital Travel Guide or the collection of registration data. The Digital Travel Guide also uses cookies for this purpose as well as Google Analytics (see 14. Cookies, Web analysis and advertisement tools, embedded contents of the "Data Privacy Statement - Websites/APPs/Services"). If you also book services in the Erlebnisshop (Experience Shop) of Ötztal Tourismus, the corresponding tickets will be displayed in the Travel Guide under the menu item "Tickets" - even if you only register for the Digital Travel Guide afterwards; this is done on the basis of a comparison of the e-mail address given in the Experience Shop, to which the guest gives his or her express consent (Art. 6 (1) lit a GDPR).

Ötztal Tourismus collects and processes your data for the purpose of providing the Digital Travel Guide including booking option and for the purpose of targeted and interest-based advertising of the products offered by Ötztal Tourismus or in the region through marketing campaigns of various kinds (e.g. sending newsletters by e-mail, sending messages in the PWA of the Digital Travel Guide). In some cases, profiling within the meaning of point 12. Profiling of the "Data Privacy Statement - Websites/APPs/Services" also takes place.

The processing of the data is based on the necessity for the provision of contractual services (Art. 6 (1) lit. b GDPR) or on your explicit consent (Art. 6 (1) lit. a GDPR).

Ötztal Tourismus collects the above-mentioned data either directly from the persons concerned or the data is transferred to Ötztal Tourismus by the accommodation providers after having obtained your separately granted consent. Your data will only be passed on to third parties to the extent this is necessary for the purpose of fulfilling the contract or processing the guest registration. If there is a legal or regulatory obligation, data will also be transmitted to public authorities (Art. 6 (1) lit. c GDPR).

Furthermore, the information about your use of the PWA is logged in a depersonalized manner in order to subsequently use it via Business Intelligent Tool (BI) to improve the service offer.

As a guest in the area of Ötztal Tourismus, you have the opportunity to receive or and use several bonus cards (Guest Card, Summer Card or Niederthai Winter Card). Obtaining and using the digital bonus cards requires the use of the Digital Travel Guide (see 06. Digital Travel Guide) and the associated user registration and corresponding data processing operations. When obtaining and using the classic (haptic) guest card (e.g. for regular bus services), the use of the Digital Travel Guide is not mandatory.

If you receive or purchase the Summer Card or the Niederthai Winter Card - which accommodation providers, Ötztal Tourismus or other distribution partners issues only at your request (in part for a fee) - the following personal data will be processed: first name, last name, date of birth, country of origin, post code, length of stay (date of arrival/departure) as well as, if applicable, payment method (including bank or credit card details). When using the bonus card, the following personal data are processed as well: data about the usage cycle of the respective card, use of the services and accommodation provider.

The processing of such personal data is necessary in order to enable identification (prevention of abuse) on the one hand, and to be able to determine the validity period of the card at the respective service provider on the other hand. In addition, central data processing is legally required under the responsibility of Ötztal Tourismus (data is recorded to a centralized card system) and necessary to allow the settlement of reductions between service providers, Ötztal Tourismus and accommodation providers.

Ötztal Tourismus collects such data either directly from those affected or data is transmitted to Ötztal Tourismus by the accommodation providers on the basis of your separately granted consent.

The processing of data is based on the necessity for the provision of contractual services (Art. 6 (1) lit. b GDPR) or on the basis of your consent (Art. 6 (1) lit. a GDPR).

In order to provide our regular guests in the holiday region with personal invitations to regular guest meetings and information about the Ötztal (e.g. community magazine) as well as to enable regular guest awarding ceremonies, Ötztal Tourismus keeps a file on regular guests. Name, address, e-mail address, number of stays, date of award as well as gifts are processed in this file. Ötztal Tourismus receives such personal data - if you have not objected - from the member businesses. Data processing takes place either on the basis of your consent (Art. 6 (1) lit. a GDPR) or due to our legitimate interest in maintaining the special customer relationship with you as well as for direct advertising (Art. 6 (1) lit. f GDPR). You can object to the processing of your personal data by Ötztal Tourismus for these purposes at any time.

Ötztal Tourismus also acts as chief organizer of countless events (e.g. sports events, regular guest meetings). If you register for such an event, we will process all personal information you provide and any follow-up data that may be required during the event. Data processing takes place for the handling of your registration, for the execution of the respective event as well as for the documentation and public communication of the event including the corresponding results. This type of data processing takes place on the basis of your explicit consent (Art. 6 (1) lit. a GDPR), the necessity to fulfil the contract stipulated (Art. 6 (1) lit. b GDPR) or due to our legitimate interests in the implementation and public communication of such an event (Art. 6 (1) lit. f GDPR).

In some cases, photos and videos are also taken in the course of our events, which may be used to portray the participants, event assistants and spectators. These photographs are processed together with information about the recording (e.g. event, location, date, name and contact details of the persons in the photo) for internal documentation on the one hand and on the other hand for the public communication of the event. Under certain circumstances, the photographs taken may also be made available to the public via print and online media, TV formats and social media channels (even outside the European Union with a possibly lower level of data protection). These data processing operations take place due to our legitimate interests in the implementation and public communication of such events (Art. 6 (1) lit. f GDPR, sec. 12 (2) cl. 4 DPA) or on the basis of any prior consent granted (Art. 6 (1) lit. a GDPR, sec. 12 (2) cl. 2 DPA). In particular, the publication also takes place on the basis of freedom of information and for journalistic purposes (Art. 85 GDPR, sec. 9 DPA, sec. 78 Copyright Act).

You are not under obligation to be photographed. Please inform the photographers and filmmakers on the spot that you do not want to be photographed or filmed already before taking the pictures. You may object to the processing of photographs on which you are recognizable and highlighted at any time within the meaning of Art. 21 (1) GDPR (for special reasons). As far as possible Ötztal Tourismus will make any effort to arrange for the deletion/anonymization of the respective photographs.

If you send us an application, we will process personal data transmitted by you (name, contact details, CV, photographs, etc.) for the purpose of evaluating your application and, if necessary, making it possible to fill a vacancy. This is due to our predominant legitimate interest in carrying out an efficient and successful application process (Art. 6 (1) lit. f GDPR) as well as on the basis of the need to carry out pre-contractual measures (Art. 6 (1) lit. b GDPR). In general, we will retain your personal data for a period of 6 months from the conclusion date of the application process, and also beyond this period with your consent (in this case your application will be kept in evidence).

Also our business partners collect and process varied personal data. This applies, for example, to name and contact details of the respective contact person, payment data, other contract data, etc. These data processing operations are required to fulfil a contractual or legal obligation (Art. 6 (1) lit. b or lit. c GDPR).

If you officially register for the Ötztaler Cycle Marathon or, respectively, apply for a start place, the following personal data will be processed: name, address, date of birth, e-mail address, jersey size, results (including intermediate times), photographs. The processing of such personal data takes place for the administration of registrations (including contact with the participants), time keeping, implementation and public communication of the event (press/media work, publication of results, photographs, etc.), billing of registration and participation fees, publication of registration form and result lists (including links to external websites whose operators create and publish photographs on their own responsibility). These data processing operations are necessary for the fulfillment of our contractual obligations (Art. 6 (1) lit. b GDPR) or take place due to our legitimate interests in the successful implementation and public communication of the event (Art. 6 (1) lit f GDPR; also see Events and Event Photography above). On the basis of your consent (Art. 6 (1) lit. a GDPR), that has to be separately granted, your personal data will also be processed for direct marketing purposes and to create a personalized user account (see thereto point 07. user accounts (Ötztal Inside Account) of the "Data Privacy Statement - Websites/APPs/Services"), if any. Data will also be passed on to our sponsors for carrying out their own direct marketing measures.

The above-mentioned data processing operations in connection with the organization of the Ötztaler Cycle Marathon are carried out with the assistance of Datasport AG (PO Box 117, Bolacker 1, 4563 Gerlafingen, +41 32 321 44 11), which acts as our data processor. A processor contract has been concluded with Datasport AG in accordance with Art. 28 GDPR.

For more detailed information on the handling of your personal data when registering for and participating in the Ötztaler Cycle Marathon, please take a look also at the Data Privacy Statement of Datasport AG (https://www.datasport.com/en/privacy-statement/). Here you will be informed about data processing by Datatsport AG under the responsibility of Ötztal Tourismus.

In the course of data processing, the operator also partly forwards personal data collected to following processors within the European Union. In order to safeguard your data protection rights, a contract was stipulated with every single processor in accordance to Art. 28 GDPR. The processors with whom Ötztal Tourismus works can be found under point 15. Processors of the "Data Privacy Statement - Websites/APPs/Services".

Personal data will only be transmitted in accordance with currently applicable laws and on a lawful basis, as well as with the utmost confidentiality and data security.

Case-related personal data is transmitted to the following categories of recipients:

• Offices, authorities (including customs, interest groups)
• Banks
• IT service providers
• Business partners, distribution partners, suppliers
• Print and online media, social media, TV broadcasters
• Debt collection, lawyers, courts, accountants
• Customers
• Leasing companies
• Member businesses of Ötztal Tourismus
• Travel service providers (hotels etc.)
• Funding bodies
• Insurance companies (on occasion only)

If the lawfulness for a specific data processing operation is based on the consent of the user, it can be revoked at any time (also partially) by sending an e-mail to . This may affect the functionality of the contents offered on this website or make the further use of our services impossible.

Furthermore, the user has a right to information about personal data concerning him/her, data portability, correction or deletion of personal data as well as limitation of or opposition to the processing of personal data. The user can exercise these rights by sending a written request including an appropriate proof of identity (photo ID) to Ötztal Tourismus, Achweg 5, 6450 Sölden, Austria.

If you fear any breach of privacy rules by the Ötztal Tourismus, we politely ask you contact us. You also have a right to send an official complaint to the Austrian Data Protection Authority (Barichgasse 40-42, 1380 Vienna, dsb@dsb.gv.at, www.dsb.gv.at).

The use of published contact data (for example as part of the mandatory imprint) for sending unsolicited advertising and information material is hereby rejected. The operators of the websites expressly reserve the right to take legal action in the event of unsolicited sending of advertising information, for example by distributing spam e-mails.